Description
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:9.6p1-1 | — |
| Debian 13 | openssh | 1:9.6p1-1 | — |
| Debian 12 | openssh | 1:9.2p1-2+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | openssh | 1:9.6p1-3ubuntu1 | — |
| Ubuntu 24.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu 22.04 LTS | openssh | 1:8.9p1-3ubuntu0.6 | USN-6565-1 |
| Ubuntu 22.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu 20.04 LTS | openssh | 1:8.2p1-4ubuntu0.11 | USN-6565-1 |
| Ubuntu 20.04 LTS | openssh-ssh1 | No fix yet | — |
| Ubuntu 18.04 LTS | openssh-ssh1 | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssh | 9.6_p1-r0 | — |
| Alpine v3.23 | openssh | 9.6_p1-r0 | — |
| Alpine v3.22 | openssh | 9.6_p1-r0 | — |
| Alpine v3.21 | openssh | 9.6_p1-r0 | — |
| Alpine v3.20 | openssh | 9.6_p1-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssh | 9.6_p1-r0 | — |
| Alpine v3.17 | openssh | 9.1_p1-r5 | — |
| Alpine v3.16 | openssh | 9.0_p1-r5 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openssh | 9.7p1-1 | — |
| Azure Linux 2 (CBL-Mariner) | openssh | 8.9p1-3 | — |
Advisories 20
- SSA-457936 SSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 Siemens ProductCERT · Nov 10, 2026
- ICSA-26-295-11 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Oct 22, 2026
- SSA-019113 SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 Siemens ProductCERT · Oct 13, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- SSA-794697 SSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1 Siemens ProductCERT · Oct 13, 2026
- ICSA-26-209-04 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Jul 28, 2026
- WID-SEC-2023-3182 OpenSSH: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 13, 2026
- USN-6565-1 openssh vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025
- VDE-2024-073 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- ICSA-25-044-09 Siemens SCALANCE W700 IEEE 802.11ax CISA ICS & IT advisories · May 6, 2025
- NCSC-2025-0061 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 14, 2025
- NCSC-2025-0051 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 11, 2025
- SSA-769027 SSA-769027: Multiple Vulnerabilities fixed in SCALANCE W700 IEEE 802.11ax devices before V3.0.0 Siemens ProductCERT · Feb 11, 2025
- WID-SEC-2024-0578 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 6, 2025
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-1082 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 9, 2024
- ICSA-23-166-11 Siemens SIMATIC S7-1500 TM MFP Linux Kernel CISA ICS & IT advisories · Apr 9, 2024
References
- https://www.openssh.com/txt/release-9.6
- https://www.openwall.com/lists/oss-security/2023/12/18/2
- https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b
- DSA-5586 vendor-advisory
- https://security.netapp.com/advisory/ntap-20240105-0005/
- https://support.apple.com/kb/HT214084
- 20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4 mailing-list